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DETAILED ACTION 

This action is in response to the papers filed 6/1 1/2008. 



Response to Arguments 

Applicant's arguments have been fully considered but they are not persuasive. Yunsk 
teaches that there is a plugin server where the user selects different plugins with logics for 
attacking individual security holes. This is the manual process of the claim language. Making the 
user select a script that selects the different plugins to be run instead of the user selecting the 
plugins to be run is not sufficient to distinguish it over the prior art. Sec In rc Vcnner, 262 F.2d 
91, 95, 120 USPQ 193, 194 (CCPA 1958) (Appellant argued that claims to a permanent mold 
casting apparatus for molding trunk pistons were allowable over the prior art because the claimed 
invention combined "old permanent-mold structures together with a timer and solenoid which 
automatically actuates the known pressure valve system to release the inner core after a 
predetermined time has elapsed." The court held that broadly providing an automatic or 
mechanical means to replace a manual activity which accomplished the same result is not 
sufficient to distinguish over the prior art.). 

Applicant's arguments with respect to Yunsk in view of Kim not teaching a "a 
springboard simulation program including a packet transmission/reception function, a process 
start/end function, a function to input/output data to/from a process, and a file transfer function; 
and a springboard simulation program control unit executing the plugin on the test target 
computer via the springboard simulation program upon instruction from the plugin" been fully 
considered but they are not persuasive. Kim teaches the functional equivalent of a springboard 
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simulation program. Since a springboard simulation program is not common term in the art and 
is just a program that runs the plugin test on a target computer. Kim clearly teaches the 
limitations in section 4 Customization. The structural body allows a use of program in the 
necessary direction by adding a necessary underlying function to be added anytime. These 
plugins can be run on the client computer (see Yunsk client structure). 

Applicant's arguments with respect to claim 5 have been considered but are moot in view 
of the new ground(s) of rejection below. 

Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claim 2-4, 7, 8, 10-15, 18 and 19 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Yunsk "Nesus Analysis Report", July 2001 in view of In re Venner, 262 F.2d 
91, 95, 120 USPQ 193, 194 (CCPA 1958) in further view of Kim "about Firewall & Network 
Security chap 10" translated to English. Yunsk teaches everything with respect to claim 1, a 
security hole diagnostic system comprising: a script accumulation unit accumulating a plurality 
of scripts (Yunsk Plugin) in a programming language describing procedures usually used by 
attackers for illegal access (see Chapter 3 Nessus installation i.e. Nessus server); an operation 
unit making a request for a list of the plurality of scripts upon entry from a user (see Chapter 3 
Nessus installation i.e. Nessus client); a script control unit retrieving each script from the script 
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accumulation unit upon the request from the operation unit, creating a list of input/output 
parameters, a script execution condition and a test procedure described thereby, and presenting 
the list of scripts to the user, and executing a script (Yunsk Plugin) that is selected by the user 
(see Chapter 3 Nessus installation Section 2) Client structure); a plugin accumulation unit 
accumulating plugins with logics for attacking individual security holes (see Chapter 3 Nessus 
installation Section 2) Client structure - Select plug-in for scanning). 

Yunsk does not teach that a plugin control unit, which is called by an execution of the 
script by the script control unit, for retrieving from the plugin accumulation unit a plugin that is 
specified by the script to be executed and executing the plugin on a test target computer; a 
springboard simulation program including a communication relay function, a packet 
transmission/reception function, a process start/end function, a function to input/output data 
to/from a process, and a file transfer function; and a springboard simulation program control unit 
executing the plugin on the test target computer via the springboard simulation program upon 
instruction from the plugin. 

Yunsk teaches that there is a plugin server where the user selects different plugins with 
logics for attacking individual security holes. It would have been obvious to have included a 
plugin control unit, which is called by an execution of the script by the script control unit, for 
retrieving from the plugin accumulation unit a plugin that is specified by the script to be 
executed and executing the plugin on a test target computer to make an automated process for 
selecting the plugins to be executed. Making the user select a script that selects the different 
plugins to be run instead of the user selecting the plugins to be run is not sufficient to distinguish 
it over the prior art. See In re Venner, 262 F.2d 91, 95, 120 USPQ 193, 194 (CCPA 1958) 
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(Appellant argued that claims to a permanent mold casting apparatus for molding trunk pistons 
were allowable over the prior art because the claimed invention combined "old permanent-mold 
structures together with a timer and solenoid which automatically actuates the known pressure 
valve system to release the inner core after a predetermined time has elapsed." The court held 
that broadly providing an automatic or mechanical means to replace a manual activity which 
accomplished the same result is not sufficient to distinguish over the prior art.). 

Kim teaches a springboard simulation program including a packet transmission/reception 
function, a process start/end function, a function to input/output data to/from a process, and a file 
transfer function (See section 4 Customization); and a springboard simulation program control 
unit executing the plugin on the test target computer via the springboard simulation program 
upon instruction from the plugin (See section 4 Customization). 

The present invention and the Nessus systems described in the cited inventions are both 
systems to give a diagnosis of a security hole (a vulnerable point) either locally or remotely. 
Their objectives and effects have similarities in that the performance is made in a plug-in 
selection form, which does not require a user to have the knowledge of input/output parameters. 

According to the present invention, however, plugins corresponding to a plurality of 
scenarios are called out from the script accumulation unit. According to the Nessus systems of 
the cited documents, on the other hand, plugins can be called out in a variety of script forms 
created in response to a user setup, which is different from the present invention. 

All the scripts provided by the present application are included in the Nassus systems of 
the cited documents 1 and 2. The Nassus systems can also execute all the plugins provided by the 
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present invention. Therefore, the present invention includes the inventions of the cited 
documents. 

Therefore, a person with ordinary skill in the art can configure the present invention 
easily based on the cited documents. The effects of the present invention can also be anticipated 
based on the cited documents. For the reasons discussed above, a patent cannot be granted. 

With respect to claim 3, wherein the script is constructed to have a function to allow it to 
call another script (see Chapter 3 Nessus installation Section 2) Client structure - Plugin 
preferences. For instance, the pop2 overflow testing need a pop count, queso plugin setup 
specifies the configuration file route). 

With respect to claim 4, wherein the script includes class concept, and wherein the script 
is constructed to have a function to allow it to call another script by specifying a class name 
when calling the another script (see Chapter 3 Nessus installation Section 2 and Client structure 
- Plugin preferences). For instance, the pop2 overflow testing need a pop count, queso plugin 
setup specifies the configuration file route). 

With respect to claim 7, wherein the script control unit, the plugin accumulation unit, the 
plugin control unit, the script accumulation unit, and the springboard simulation program control 
unit form a test execution unit, and the test execution unit and the operation unit are disposed 
separately on a network (See section 1 Nessus Structure). 

With respect to claim 8, wherein the plugin is described in an interpreter language (see 
Chapter 3 Nessus installation). 

With respect to claim 10, said script control unit also adding new and updated scripts to 
said script accumulation unit at the direction of the user (See Kim section 1 Nessus Strusture). 
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With respect to claim 1 1 , said script control unit also executing a script that is called by 
another script (See Kim section 1 Nessus Strusture). 

With respect to claim 12, wherein the communications relay function communicates with 
a second springboard simulation program (See Kim section 4 Customization). 

With respect to claim 13, wherein the communications relay function communicates with 
a springboard simulation program control unit over a network (See Kim section 4 
Customization). 

With respect to claim 14, wherein the communications relay function transmits an 
incoming control message to the operation unit (See Kim section 4 Customization). 

With respect to claim 15, wherein the operation unit transmits an outgoing or misdirected 
control message through the communications relay function (See Kim section 4 Customization). 

With respect to claim 18, wherein the test execution unit is disposed outside of a firewall, 
and the operation unit is disposed inside of a firewall (See section 1 Nessus Structure). 

With respect to claim 19, said plugins being editable while a diagnostic script is running 
(see Chapter 3 Nessus installation Section 2) Client structure). 

Claim 9 are rejected under 35 U.S.C. 103(a) as being unpatentable over Yunsk "Nesus 
Analysis Report", July 2001 in view of In re Venner, 262 F.2d 91, 95, 120 USPQ 193, 194 
(CCPA 1958) in view of Kim "about Firewall & Network Security chap 10" translated to English 
in further view of Uchiyama (U.S. 2002/0024686). Yunsk Venner and Kim teach everything 
with respect to claim 2 above but with respect to claim 9 they do not teach wherein the 
springboard simulation program control unit is constructed by using a protocol designed to pass 
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firewalls. Uchiyama teaches wherein the springboard simulation program control unit is 
constructed by using a protocol designed to pass firewalls (See Uchiyama paragraph 0088). It 
would have been obvious at the time the invention was made to a person having ordinary skill in 
the art to which said subject matter pertains to have used a protocol that can pass firewalls to 
allow messages to be passed between the server the client. Therefore one would have been 
motivated to have used a protocol that can pass firewalls (See Uchiyama paragraph 0088). 

Claims 5, 6, 16, 17, 20 and 21 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Yunsk "Nesus Analysis Report", July 2001 in view of In re Venner, 262 F.2d 91, 95, 120 
USPQ 193, 194 (CCPA 1958) in view of Kim "about Firewall & Network Security chap 10" 
translated to English in further view of Curtis et al (U.S. 6,507,948). 

Yunsk, Venner and Kim teach with respect to claim 5, comprising: a security hole 
diagnostic system comprising: a script accumulation unit accumulating a plurality of scripts 
(Yunsk Plugin) in a programming language describing procedures usually used by attackers for 
illegal access (see Chapter 3 Nessus installation i.e. Nessus server); an operation unit making a 
request for a list of the plurality of scripts upon entry from a user (see Chapter 3 Nessus 
installation i.e. Nessus client); a script control unit retrieving each script from the script 
accumulation unit upon the request from the operation unit, creating a list of input/output 
parameters, a script execution condition and a test procedure described thereby, and presenting 
the list of scripts to the user, and executing a script (Yunsk Plugin) that is selected by the user 
(see Chapter 3 Nessus installation Section 2) Client structure); a plugin accumulation unit 
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accumulating plugins with logics for attacking individual security holes (see Chapter 3 Nessus 
installation Section 2) Client structure - Select plug-in for scanning). 

Yunsk does not teach that a plugin control unit, which is called by an execution of the 
script by the script control unit, for retrieving from the plugin accumulation unit a plugin that is 
specified by the script to be executed and executing the plugin on a test target computer; a 
knowledge sharing unit verifying whether the script execution condition is met, wherein the 
knowledge sharing unit includes, a deduction unit deriving new knowledge from information 
collected in an execution process of the script based on a deduction rule. 

Yunsk teaches that there is a plugin server where the user selects different plugins with 
logics for attacking individual security holes. It would have been obvious to have included a 
plugin control unit, which is called by an execution of the script by the script control unit, for 
retrieving from the plugin accumulation unit a plugin that is specified by the script to be 
executed and executing the plugin on a test target computer to make an automated process for 
selecting the plugins to be executed. Making the user select a script that selects the different 
plugins to be run instead of the user selecting the plugins to be run is not sufficient to distinguish 
it over the prior art. See In re Venner, 262 F.2d 91, 95, 120 USPQ 193, 194 (CCPA 1958) 
(Appellant argued that claims to a permanent mold casting apparatus for molding trunk pistons 
were allowable over the prior art because the claimed invention combined "old permanent-mold 
structures together with a timer and solenoid which automatically actuates the known pressure 
valve system to release the inner core after a predetermined time has elapsed." The court held 
that broadly providing an automatic or mechanical means to replace a manual activity which 
accomplished the same result is not sufficient to distinguish over the prior art.). 
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Curtis teaches a knowledge sharing unit verifying whether the script execution condition 
is met, wherein the knowledge sharing unit includes, a deduction unit deriving new knowledge 
from information collected in an execution process of the script based on a deduction rule (see 
column 2 lines 16-24 and column 7 lines 33-63). It would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter 
pertains to have permissions for executing batch or script files to only allow allowed users to 
execute the batch or script files (see Curtis column 7 lines 33-63). Therefore one would have 
been motivated to have included permissions for executing batch or script files. 

With respect to claim 6, wherein the knowledge sharing unit is constructed to have a 
function to execute a script for acquiring knowledge based on the deduction rule when shared 
knowledge is insufficient (see column 2 lines 16-24 and column 7 lines 33-63). 

With respect to claim 16, the script execution condition comprising a predicate calculus 
based description of the conditions required for executing the script. Curtis teaches the script 
execution condition comprising a predicate calculus based description of the conditions required 
for executing the script (see Curtis column 2 lines 16-24 and column 7 lines 33-63). It would 
have been obvious at the time the invention was made to a person having ordinary skill in the art 
to which said subject matter pertains to have permissions for executing batch or script files to 
only allow allowed users to execute the batch or script files (see Curtis column 7 lines 33-63). 
Therefore one would have been motivated to have included permissions for executing batch or 
script files. 
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With respect to claim 17, wherein said knowledge sharing unit determines whether script 
execution conditions have been met and communicates said determination to said script control 
unit (see Curtis column 2 lines 16-24 and column 7 line 33-63). 

With respect to claim 20 and 21, a security hole diagnostic system comprising: 
accumulating a plurality of scripts (Yunsk Plugin) in a programming language describing 
procedures usually used by attackers for illegal access (see Chapter 3 Nessus installation i.e. 
Nessus server); retrieving at a list of least one of said plurality of script from the script 
accumulation unit upon the request from the operation unit, creating a list of input/output 
parameters, a script execution condition and a test procedure described thereby; presenting the 
list of scripts to the user, and executing a script (Yunsk Plugin) that is selected by the user (see 
Chapter 3 Nessus installation Section 2) Client structure); retrieving from a plugin accumulation 
unit accumulating plugins with logics for attacking individual security holes (see Chapter 3 
Nessus installation Section 2) Client structure - Select plug-in for scanning). 

Yunsk does not teach that a plugin control unit, which is called by an execution of the 
script by the script control unit, for retrieving from the plugin accumulation unit a plugin that is 
specified by the script to be executed and executing the plugin on a test target computer; 
verifying whether the script execution condition is met deriving new knowledge from 
information collected in an execution process of the script based on a deduction rule. 

Yunsk teaches that there is a plugin server where the user selects different plugins with 
logics for attacking individual security holes. It would have been obvious to have included a 
plugin control unit, which is called by an execution of the script by the script control unit, for 
retrieving from the plugin accumulation unit a plugin that is specified by the script to be 
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executed and executing the plugin on a test target computer to make an automated process for 
selecting the plugins to be executed. Making the user select a script that selects the different 
plugins to be run instead of the user selecting the plugins to be run is not sufficient to distinguish 
it over the prior art. See In re Venner, 262 F.2d 91, 95, 120 USPQ 193, 194 (CCPA 1958) 
(Appellant argued that claims to a permanent mold casting apparatus for molding trunk pistons 
were allowable over the prior art because the claimed invention combined "old permanent-mold 
structures together with a timer and solenoid which automatically actuates the known pressure 
valve system to release the inner core after a predetermined time has elapsed." The court held 
that broadly providing an automatic or mechanical means to replace a manual activity which 
accomplished the same result is not sufficient to distinguish over the prior art.). 

Curtis teaches verifying whether the script execution condition is met deriving new 
knowledge from information collected in an execution process of the script based on a deduction 
rule (see Curtis column 2 lines 16-24 and column 7 line 33-63). It would have been obvious at 
the time the invention was made to a person having ordinary skill in the art to which said subject 
matter pertains to have permissions for executing batch or script files to only allow allowed users 
to execute the batch or script files (see Curtis column 7 lines 33-63). Therefore one would have 
been motivated to have included permissions for executing batch or script files. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Devin Almeida whose telephone number is 571-270- 
1018. The examiner can normally be reached on Monday-Thursday from 7:30 A.M. to 
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5:00 P.M. The examiner can also be reached on alternate Fridays from 7:30 A.M. to 
4:00 P.M. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron, can be reached on 571-272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

/Devin Almeida/ 
Examiner, Art Unit 2132 
7/23/2008 



/Benjamin E Lanier/ 

Primary Examiner, Art Unit 2132 



